Financial Fraud Through the Theft of Bank Card Data: A Systematic Analytical Review

Full text

The scholarly problem is that the methods of card-data theft (phishing, skimming, e-skimming, carding, and others) are often examined separately in the literature, while their connection as a single economic chain – from theft through to the monetization of stolen data on the carding market – remains insufficiently systematized. This fragmentation in turn leads to the piecemeal application of protective measures.

This article is analytical (review) in character: it does not conduct a new empirical experiment but rather synthesizes existing scholarly literature, industry reports, and international instruments through comparative and systematic analysis in order to generalize the methods of card-data theft and their consequences. The aim of the study is to systematize the methods of stealing bank card data and to analyze their role in the formation of financial harm. From this aim, the following objectives were defined:

1. to analyze and classify the principal methods of card-data theft (phishing, fake payment pages, skimming/e-skimming, carding, CVV/OTP deception);
2. to examine the subsequent use of stolen data and its circulation on the carding market;
3. to generalize the mechanism by which financial harm is formed;
4. to outline the context of legal qualification and to formulate practical recommendations.

This analytical work is based not on empirical testing but on the systematic study of existing sources and financial-sector reports. The following methods were applied:

• Comparative-analytical method, used to compare the methods of card-data theft with one another according to their technical features and effectiveness.
• Systematic approach, used to consider individual methods as links in a single economic chain extending from theft to monetization.
• Descriptive-statistical analysis, used to aggregate the quantitative data contained in reports on financial fraud.
• Formal-legal method, used to delineate the context of the legal qualification of the conduct concerned.

Source base. Several categories of source were drawn upon: (a) peer-reviewed international scholarly publications (academic research on the cloning of EMV cards, defence against e-skimmers, and the detection of payment fraud through machine learning) [6, 7, 8, 9]; (b) industry and security reports and statistical sources [1, 2, 3, 10, 11, 12, 13, 14, 15]; (c) official and academic sources relating to Uzbekistan (statistics of the Ministry of Internal Affairs Cybersecurity Centre and national peer-reviewed analyses) [4, 5, 16]; and (d) international and national legal instruments – the Council of Europe Convention on Cybercrime [17] and the Criminal Code and sectoral laws of the Republic of Uzbekistan [18, 19, 20, 21]. The legal norms should be additionally verified by the author against the current redaction via lex.uz.

A limitation of the study is that the statistical indicators cited reflect the state of affairs at the time the sources were published and remain relative in a rapidly changing field.

A general framework for card-data theft

It is expedient to divide the methods of stealing payment card data into two broad groups: (1) physical/device-based methods – skimming and shimming, that is, the capture of data from physical devices such as ATMs or payment terminals; and (2) digital/online methods – phishing, fake payment pages, and e-skimming, that is, the acquisition of data within the internet environment. Both groups ultimately produce the same product – saleable card credentials – and therefore feed into a common “carding” economy (Section 3.5).

Phishing and fake payment pages

Phishing is a method of deceiving a user, in the name of a trusted organization (a bank, payment system, or government service), into voluntarily entering card credentials. According to the Verizon [15] Data Breach Investigations Report, phishing remains one of the principal vectors in credential-related breaches, and users often respond to a phishing message in less than a minute: on average 21 seconds elapse before a link is clicked and a further 28 seconds before data is entered [15]. In its analysis of the finance sector, ENISA [11] notes that phishing, smishing (phishing via SMS), and vishing (deception via telephone call) are the principal forms of social-engineering attack, with individuals targeted in approximately 38 per cent of cases and banks in 36 per cent.

A fake payment page is the technical manifestation of phishing, operating through a page that imitates the interface of a legitimate bank or payment system. When a user is directed to such a page (typically via a malicious link), they enter the card number, expiry date, and CVV code, and these data are transmitted directly to the attacker's server. The ENISA [11] report specifically emphasizes the large-scale theft of card data resulting from the impersonation of banks and from successful phishing and smishing.